Contents
Short answer
For many small businesses the key steps are a current router with firewall, separate networks for guests and devices, and no unprotected remote access. A VPN does not automatically make a business secure. Zero Trust is not a product but a principle: check every access individually.
Why does this matter for small businesses?
Open remote maintenance access and outdated routers or VPN appliances are actively searched for and attacked. Meanwhile many teams now work mostly in the cloud – protection then shifts from the office network to accounts and devices.
What does it include?
Router and firewall
Current firmware, changed admin password, no unnecessary port forwarding.
Basic
Wi-Fi
WPA3 or WPA2, separate guest network, own network for printers, cameras and smart-office devices.
Basic
DNS filtering
Blocks known harmful domains for all devices – as an addition, not sole protection.
Useful as IT grows
VPN and remote access
Access to internal systems only via secured routes with MFA. VPN appliances must be updated especially quickly.
Useful as IT grows
Zero Trust as a concept
No blanket trust in the internal network: access is granted individually by person, device and context. Implemented through several building blocks, not a single product.
Relevant with higher risk
What does it protect against?
- Direct internet attacks on exposed services
- Guest devices or cameras reaching the work network
- Visits to known harmful domains
What does it not protect against?
- Compromised cloud accounts
- Phishing by email
- Attackers signing in with valid VPN credentials
Which basic measures are often enough?
- 01Router firmware current and admin password changed
- 02Guest and device networks separated
- 03Remote maintenance enabled only when needed
- 04MFA for every remote access
When does a more advanced solution make sense?
Dedicated firewalls with logging, segmented networks and zero-trust approaches become relevant with internal servers, several sites, sensitive data or external providers with access. Cloud-only businesses without internal servers often do not need a classic VPN at all.
Common mistakes
- Leaving remote maintenance permanently open
- Running a VPN without MFA
- Forgetting router updates
- Cameras and printers on the same network as accounting PCs
Checklist
- No unused port forwards
- Guest network separate
- Remote access only with MFA
- VPN and router updates applied promptly
- List of all external access points exists
Frequently asked questions
Do we need a VPN?
Only if internal systems must be reachable from outside. If you work entirely in the cloud, MFA and secure devices usually protect more.
Is Zero Trust for small businesses?
The principle, yes: assume little trust, limit access. A full implementation usually only pays off with larger IT.
Sensible next step
Have someone check which services on your network are reachable from the internet, and close unused ones.
Sources
- Bundesamt für Sicherheit in der Informationstechnik (BSI)
- CISA – Cybersecurity and Infrastructure Security Agency
- NIST Cybersecurity Framework
Checked on 6 Oct 2026.
General orientation – does not replace an individual security review, legal or data-protection advice.